Cyber Threat Actor: Group123
| Actor Type | Location | Known Incidents |
Nation State
|
South Korea
|
0 incidents |
|---|
Profile
Group123 is a threat actor alias associated with North Korean cyber operations, as indicated by public attribution linking the group to the Kimsuky malware family used by North Korean hackers. The actor’s known location is North Korea, and its activities have been traced to network addresses in northeast China near the North Korean border. Group123 primarily targets the nuclear energy sector, as demonstrated by its intrusion into Korea Hydro and Nuclear Power (KHNP), the operator of South Korea’s nuclear reactors. The actor’s strategic objectives include financial gain through extortion, disruption via threats to shut down reactors and cause destruction, and espionage by stealing technical data and threatening to sell sensitive nuclear program information.
The group’s typical tactics involve large‑scale phishing campaigns as an initial access vector, with the KHNP attack employing 5,986 phishing emails sent to 3,571 employees. The malware deployed in these operations is identified as the Kimsuky family, which was compiled on a system configured for the Korean language, indicating a specific tooling style. Beyond email‑based delivery, Group123 leverages social media platforms such as Twitter to leak stolen data, issue demands, and communicate threats, using accounts that claim affiliations with activist groups to mask its true intent.
A notable publicly reported operation is the 2015 compromise of KHNP, during which the actor exfiltrated personal information of 10,799 employees, obtained partial blueprints of nuclear facilities, and released technical manuals and reactor design documents. Following the intrusion, Group123 demanded an unspecified payment, threatened the shutdown of three reactors, and warned of further data releases if its demands were not met, while also claiming to possess data on South Korea’s indigenous nuclear reactor program that it offered to sell. This campaign exemplifies the actor’s blend of financial extortion, disruptive threats, and espionage‑focused data theft.